Cryptography 2 / Cryptographic Protocols 1 Spring Semester 2014

Cryptography 2 / Cryptographic Protocols 1 Spring Semester 2014 Where’s Waldo? Berry Schoenmakers Coding & Crypto group Department of Mathematics & Computer Science

Zero-knowledge proofs Q1: How to convince a (skeptical) verifier that you know the solution to a puzzle? A1: Simply show the solution! Q2: Same question, but now you don’t want to give away any information on the solution? A2: Prove in zero-knowledge that you know the solution.

Where’s Waldo? Find in Waldo (a.k.a. Wally)

In what sense is this zero-knowledge? • Peephole shows nothing but Waldo, and we already know how Waldo looks. • In other words, you could make this final view yourself without any help of the prover: • Stick a small picture of Waldo behind the peephole • In crypto speak: you can simulate the view • Simulation paradigm: “everything that the verifier learns from the proof, could be constructed (efficiently) by the verifier itself – without knowing the solution”

Soundness • The proof should also be sound: • Prover only be able to convince the verifier if the prover actually knows the solution • So, cheating as done in a simulation should be excluded: • make sure prover doesn’t have small pictures of Waldo hidden somewhere – checking this may be awkward • Achieving soundness & zero-knowledge can be done efficiently based on number-theoretic constructions.

How about arbitrary puzzles ? • NP-complete problems are notoriously hard “puzzles” • Example: traveling salesman problem • Proving that you know a solution amounts to proving that you know how make a certain Boolean formula φ evaluate to true Example: φ = (w ¬x  y)  (x  ¬y  z)  … • Formula φ is very big, and it gets very hard to make all clauses true at the same time. • Suppose we know a solution, let’s prove this in zero-knowledge – using lots of Waldo puzzles.

Boolean connectives: AND, OR, NOT • AND “” • take two puzzles • prove that you know solutions to both of them • OR “” • take two puzzles • prove that you know solution to one of them without showing which puzzle you are solving • NOT “¬” • cut one puzzle in half • prove where Waldo is in one piece • then Waldo is not present in the other piece

Zeroknowledge satisfiability of φ ¬w w ¬x x ¬y y • Let φ = (w  ¬x  y)  (x  ¬y  z)  … and suppose you know what value to assign to w,x,y,… to make φ = true • For each variable, say w, do this: • cut a puzzle in half • label the piece where Waldo is with w if w=true, and with ¬w if w=false • label the other piece with the complement • For each clause, say w  ¬x  y, do an OR proof: • select the pieces labeled by w, ¬x, y • Waldo is in at least one of these pieces • prove that you know where Waldo is in one of these pieces without showing in which piece

Zero-knowledge applications. • Secure identification: prove that you know the secret key without giving away any other information • contrasts sharply with use of passwords • more like challenge-response protocols • Allows for selective disclosure of information: • prove that you are over 21, without giving any more information on your age • Generally, zero-knowledge proofs are used in cryptography to let a party prove that it behaved according to the protocol • E.g., ElGamal encryption contains vote v ∈ {0,1}

References Zero-knowledge proofs for knowledge of solutions to Where’s Waldopuzzles is from: “Applied Kid Cryptography or How To Convince Your Children You Are Not Cheating” by Moni Naor, Yael Naor, Omer Reingold, Journal of Craptology, Volume 0, No 1 http://www.anagram.com/jcrap/Volume_0_1/crv0n1-3.pdf Use of Where’s Waldo puzzles to prove arbitrary NP-statements is from: “Crypto 2.0: Achieving Security and Privacy at the Same Time” by Berry Schoenmakers, presentation at SuperTU/esday, February 11th, 2010. http://w3.win.tue.nl/nl/supertuesday_on_digital_security_thursday_11_february_2010

Cryptography 2 / Cryptographic Protocols 1 Spring Semester 2014